aws_vpc_endpoint does not autoaccept

[loleebr]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.13.0

• provider registry.terraform.io/-/aws v3.1.0
• provider registry.terraform.io/-/http v1.2.0
• provider registry.terraform.io/-/tls v2.2.0
• provider registry.terraform.io/hashicorp/aws v3.1.0
• provider registry.terraform.io/hashicorp/http v1.2.0
• provider registry.terraform.io/hashicorp/null v2.1.2
• provider registry.terraform.io/hashicorp/tls v2.2.0

Affected Resource(s)

• aws_vpc_endpoint
• aws_vpc_endpoint_service

Terraform Configuration Files

##### Endpoint Acceptance Test
##### Endpoint Service Creation
resource "aws_vpc_endpoint_service" "networkloadbalancer" {
  acceptance_required        = true
  network_load_balancer_arns = [aws_lb.networkloadbalancer.arn]
  tags = {
    Name         = "test-service-vpc-nlb-port-80-target"
    Generated-By = "terraform"
    Managed-By   = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {
    ignore_changes  = [tags["BuildUser"]]
    prevent_destroy = false
  }
}


##### Endpoint Creation
resource "aws_vpc_endpoint" "networkloadbalancer" {
  vpc_id              = aws_vpc.test_consumer_vpc.id
  service_name        = aws_vpc_endpoint_service.networkloadbalancer.service_name
  auto_accept         = true
  vpc_endpoint_type   = "Interface"
  security_group_ids  = [aws_default_security_group.test_consumer_vpc.id]
  subnet_ids          = [aws_subnet.test_consumer_vpc.id]
  private_dns_enabled = false
  tags = {
    Name         = "test-service-vpc-nlb-port-80-target"
    Generated-By = "terraform"
    Managed-By   = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {
    ignore_changes  = [tags["BuildUser"]]
    prevent_destroy = false
  }
}



##### Variables for environment
variable "aws_region" {
  description = "AWS Region where the module is run"
  default = "us-east-1"
}
variable "build_user" {
  description = "Employee ID that is running the terraform code"
  default = "test-user"
}
variable "availability_zone" {
  description = "AZ to build the resources in"
  default = "us-east-1a"
}

##### Setup environment pre-requisites
### Metadata
provider "aws" {
  region = var.aws_region
}

provider "null" {}

data "aws_caller_identity" "current" {}

data "http" "myip" {
  url = "http://ipv4.icanhazip.com"
}
locals {
  myip = chomp(data.http.myip.body)
}
### End Metadata

### VPCs
resource "aws_vpc" "test_service_vpc" {
  cidr_block       = "192.168.1.0/24"
  instance_tenancy = "default"
  tags = {
    Name         = "test_service_vpc"
    Managed-By   = "terraform"
    Generated-By = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {ignore_changes = [tags["BuildUser"]]}
}

resource "aws_vpc" "test_consumer_vpc" {
  cidr_block       = "192.168.2.0/24"
  instance_tenancy = "default"
  tags = {
    Name         = "test_consumer_vpc"
    Managed-By   = "terraform"
    Generated-By = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {ignore_changes = [tags["BuildUser"]]}
}
### End VPCs

### Subnets
resource "aws_subnet" "test_service_vpc" {
  vpc_id                  = aws_vpc.test_service_vpc.id
  availability_zone       = var.availability_zone
  cidr_block              = aws_vpc.test_service_vpc.cidr_block
  map_public_ip_on_launch = "false"
  tags = {
    Name         = "test_service_vpc subnet"
    Managed-By   = "terraform"
    Generated-By = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {ignore_changes = [tags["BuildUser"]]}
}

resource "aws_subnet" "test_consumer_vpc" {
  vpc_id                  = aws_vpc.test_consumer_vpc.id
  availability_zone       = var.availability_zone
  cidr_block              = aws_vpc.test_consumer_vpc.cidr_block
  map_public_ip_on_launch = "false"
  tags = {
    Name         = "test_consumer_vpc subnet"
    Managed-By   = "terraform"
    Generated-By = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {ignore_changes = [tags["BuildUser"]]}
}
### End Subnets

### Internet Gateway
resource "aws_internet_gateway" "test_service_vpc" {
  vpc_id = aws_vpc.test_service_vpc.id
  tags = {
    Name         = "test_service_vpc subnet"
    Managed-By   = "terraform"
    Generated-By = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {ignore_changes = [tags["BuildUser"]]}
}

### Routes
resource "aws_default_route_table" "test_service_vpc" {
  default_route_table_id = aws_vpc.test_service_vpc.default_route_table_id
  tags = {
    Name         = "test_service_vpc-default"
    Managed-By   = "terraform"
    Generated-By = "terraform"
    BuildUser    = var.build_user
    Managed-By   = "terraform"
  }
  lifecycle {
    ignore_changes = [
      tags["BuildUser"],
      propagating_vgws
    ]
  }
}
resource "aws_route" "test_service_vpc_igw" {
  route_table_id         = aws_vpc.test_service_vpc.default_route_table_id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = aws_internet_gateway.test_service_vpc.id
}

resource "aws_default_route_table" "test_consumer_vpc" {
  default_route_table_id = aws_vpc.test_consumer_vpc.default_route_table_id
  tags = {
    Name         = "test_consumer_vpc-default"
    Managed-By   = "terraform"
    Generated-By = "terraform"
    BuildUser    = var.build_user
    Managed-By   = "terraform"
  }
  lifecycle {
    ignore_changes = [
      tags["BuildUser"],
      propagating_vgws
    ]
  }
}

### Security Groups
resource "aws_default_security_group" "test_service_vpc" {
  vpc_id = aws_vpc.test_service_vpc.id
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    description = "Allows egress for ${aws_vpc.test_service_vpc.tags.Name}"
  }
  ingress {
    protocol  = "-1"
    from_port = 0
    to_port   = 0
    cidr_blocks = [
      aws_vpc.test_service_vpc.cidr_block,
      "${local.myip}/32"
    ]
    description = "Allows ingress for ${aws_vpc.test_service_vpc.tags.Name} from internal and myip"
  }
  tags = {
    Name         = "test_service_vpc-default"
    Managed-By   = "terraform"
    Generated-By = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {ignore_changes = [tags["BuildUser"]]}
}

resource "aws_default_security_group" "test_consumer_vpc" {
  vpc_id = aws_vpc.test_consumer_vpc.id
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    description = "Allows egress for ${aws_vpc.test_consumer_vpc.tags.Name}"
  }
  ingress {
    protocol  = "-1"
    from_port = 0
    to_port   = 0
    cidr_blocks = [
      aws_vpc.test_consumer_vpc.cidr_block,
      "${local.myip}/32"
    ]
    description = "Allows ingress for ${aws_vpc.test_consumer_vpc.tags.Name} from internal and myip"
  }
  tags = {
    Name         = "test_consumer_vpc-default"
    Managed-By   = "terraform"
    Generated-By = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {ignore_changes = [tags["BuildUser"]]}
}

### Keypair
resource "tls_private_key" "keygen" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "aws_key_pair" "key_pair" {
  key_name   = aws_vpc.test_service_vpc.tags.Name
  public_key = tls_private_key.keygen.public_key_openssh
}

### Create Service Instance
data "aws_ami" "instance" {
  most_recent = true
  filter {
    name   = "name"
    values = ["amzn2-ami-hvm-2.0*"]
  }
  owners = ["amazon"]
}

### Create Instance based on found AMI
resource "aws_instance" "instance" {
  ami                         = data.aws_ami.instance.image_id
  instance_type               = "t3.micro"
  key_name                    = aws_key_pair.key_pair.key_name
  vpc_security_group_ids      = [aws_default_security_group.test_service_vpc.id]
  subnet_id                   = aws_subnet.test_service_vpc.id
  associate_public_ip_address = true
  tags = {
    Generated-By  = "terraform"
    Managed-By    = "terraform"
    BuildUser     = var.build_user
    Name          = "test_service_vpc - endpoint instance"
    Business      = "testing"
    Customer      = "testing"
    Description   = "instance for aws_endpoint_service testing"
    Environment   = "testing"
    Platform      = "testing"
    ProductName   = "testing"
    ProvisionDate = timestamp()
    TerraformName = "test_service_vpc - endpoint instance"
    Account       = data.aws_caller_identity.current.account_id
    Image         = data.aws_ami.instance.name
  }
  lifecycle {
    ignore_changes  = [ami, tags, ebs_optimized]
    prevent_destroy = false
  }
}

##### Network Load Balancer
### Create Network Load Balancer
resource "aws_lb" "networkloadbalancer" {
  name                       = "test-service-vpc-nlb-port-80"
  internal                   = true
  load_balancer_type         = "network"
  subnets                    = [aws_subnet.test_service_vpc.id]
  enable_deletion_protection = false
  tags = {
    Generated-By = "terraform"
    Managed-By   = "terraform"
    BuildUser    = var.build_user
    Name         = "test-service-vpc-nlb-port-80-target"
  }
  lifecycle {
    ignore_changes  = [tags["BuildUser"]]
    prevent_destroy = false
  }

}

## Create Load Balancer Target Group
resource "aws_lb_target_group" "networkloadbalancer" {
  name     = "test-service-vpc-nlb-port-80"
  port     = "80"
  protocol = "TCP"
  vpc_id   = aws_vpc.test_service_vpc.id
  tags = {
    Name         = "test-service-vpc-nlb-port-80-target"
    Generated-By = "terraform"
    Managed-By   = "terraform"
    BuildUser    = var.build_user
  }
  lifecycle {
    ignore_changes  = [tags["BuildUser"]]
    prevent_destroy = false
  }
}

## Create Load Balancer Target Registration
resource "aws_lb_target_group_attachment" "networkloadbalancer" {
  target_group_arn = aws_lb_target_group.networkloadbalancer.arn
  target_id        = aws_instance.instance.id
  port             = "80"
}

### Customer Load Balancer Listener
resource "aws_lb_listener" "networkloadbalancer" {
  load_balancer_arn = aws_lb.networkloadbalancer.arn
  port              = "80"
  protocol          = "TCP"
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.networkloadbalancer.arn
  }
  depends_on = [aws_lb_target_group_attachment.networkloadbalancer]
}
##### End Network Loadbalancer

##### End of environment setup

Debug Output

https://gist.github.com/loleebr/a9965e9e03ef9b176874768f71faef8f

Panic Output

Expected Behavior

Terraform Apply success with Endpoint created and autoaccepted by the Endpoint service

Actual Behavior

Endpoint Created but does not autoaccept. AWS Console shows as PENDING ACCEPTANCE

Terraform CLI error:

aws_vpc_endpoint.networkloadbalancer: Creating...

Error: error waiting for VPC Endpoint (vpce-02936ec8fb99868f3) to be accepted: unexpected state 'pending', wanted target 'available'. last error: %!s(<nil>)

  on main.tf line 21, in resource "aws_vpc_endpoint" "networkloadbalancer":
  21: resource "aws_vpc_endpoint" "networkloadbalancer" {

Steps to Reproduce

1. Run terraform apply on the above config

Important Factoids

References

• #0000

[michal-malec]

I ran into the same problem:

Error: error waiting for VPC Endpoint (vpce-0ae38a8f105425e45) to be accepted: unexpected state 'pending', wanted target 'available'. last error: %!s(<nil>)

Terraform v0.13.5
hashicorp/aws v3.25.0

It occurs while creating VPC Endpoint for PrivateLink with auto_accept set to true. It seems that issue can be here:

terraform-provider-aws/aws/resource_aws_vpc_endpoint.go

Line 409 in cfd1893

Target: []string{"available"},

After accepting, endpoint's status goes to pending and then after some time it changes to available (pendingAcceptance -> pending -> available).

Workaround (if you don't want to perform changes through AWS console):

1. Set auto_accept to false and apply terraform. It will succeed, but VPC Endpoint will be in pendingAcceptance state.
2. Set auto_accept to true and apply terraform. It will fail, but VPC Endpoint will soon change to available state.
3. Set auto_accept to false and apply terraform. It will succeed.
4. (Optional) Set auto_accept to true and apply terraform. It will succeed.

[ghost]

This has been released in version 3.38.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.